Amazing work. But this is just a small step. You do need to block many Mozilla domains on your firewall or Pi-Hole because most of the times even Firefox does not respect your privacy.
If you reading this still use Windows, I'm sorry for you. Really.
If you are using Linux, please use OpenSnitch to block this abusive pattern.
I hope these guys will add those settings to their also amazing job like:
https://github.com/arkenfox/user.js
https://github.com/pyllyukko/user.js
These are config lists that I also use and it would be great to have this on those lists.
Again, thank you for your amazing work. I will apply this for LibreWolf also.
In Firefox Privacy Guidepyllyukko
user.js
JavaScript2015–2025
pyllyukko / user.js
user.js
user.js -- Firefox configuration hardening
32Distinct people
39Mentions
1Explicit recommenders
2.9KGitHub stars
What to know before exploring
What it is
user.js -- Firefox configuration hardening
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Mozilla is going on the completely opposite direction of what their supporters (and previous contributors) want them to go. Yes, they provide mobile browsers, plus a browser…
sdlkfgj used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- arkenfox/user.js · linked in 3 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:03:16 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year39 dated mentions
Observed mentions: 2015-01-27 15:44:18 UTC to 2025-09-02 18:35:17 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
user.js
Firefox configuration hardening
A user.js configuration file for Mozilla Firefox designed to harden browser settings and make it more secure.
This is a default template with every possible hardening measure enforced. See the relaxed branch for a variant providing more usability
Main goals
Limit the possibilities to track the user through web analytics.
Harden the browser against known data disclosure or code execution vulnerabilities.
Limit the browser from storing anything even remotely sensitive persistently.
Make sure the browser doesn't reveal too much information to shoulder surfers.
Harden the browser's encryption (cipher suites, protocols).
Limit possibilities to uniquely identify the browser/device using browser fingerprinting.
Hopefully limit the attack surface by disabling various features.
Still be usable in daily use.
How to achieve this?
There are several parts to all this and they are:
Downloading and installing the user.js file.
Reading about and applying further hardening techniques.
Optional: Modifying user.js to adapt it to your web browser usage.
Download
Installation
What does it do?
Further hardening
Known problems and limitations
FAQ
Contributing
Online tests
References
Maintenance
Download
Different download methods are available:
Clone using git: git clone https://github.com/pyllyukko/user.js
Download and extract the ZIP file containing the latest version.
Download the latest user.js directly
Installation
Backups
Do note that these settings alter your browser behaviour quite a bit, so it is recommended to either create a completely new profile for Firefox or backup your existing profile directory before putting the user.js file in place.
To enable the Profile Manager, run Firefox with command-line arguments: firefox --no-remote -P
Single profile installation
Copy user.js in your current user profile directory, or (recommended) to a fresh, newly created Firefox profile directory.
The file should be located at:
OS
Path
Windows 7
%APPDATA%\Mozilla\Firefox\Profiles\XXXXXXXX.your_profile_name\user.js
Linux
~/.mozilla/firefox/XXXXXXXX.your_profile_name/user.js
OS X
~/Library/Application Support/Firefox/Profiles/XXXXXXXX.your_profile_name
Android
/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name and see issue #14
Sailfish OS + Alien Dalvik
/opt/alien/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name
Windows (portable)
[firefox directory]\Data\profile\
With this installation method, if you change any of user.js settings through about:config or Firefox preferences dialogs, they will be reset to the user.js defined values after you restart Firefox. This makes sure they're always back to secure defaults when starting the browser. However this prevents persistently changing settings you don't consider appropriate. Either edit user.js directly, or use the system-wide installation method described below.
System-wide installation (all platforms)
Generate a file suitable for system-wide installation, by running make with one of the following targets:
systemwide_user.js: (the value will be used as default value for all Firefox Profiles where it is not explicitly set, it can be changed in about:config and is kept across browser sessions)
locked_user.js: (the value will be used as default value on Firefox profile creation, will be locked and can't be changed) in user.js or in Firefox's about:config or settings.
debian_locked.js: Debian specific. Users are not able to override preferences. See #415.
Copy the produced file to the Firefox installation directory. The file should be located at:
OS
Path
Windows
C:\Program Files (x86)\Mozilla Firefox\mozilla.cfg
Linux
/etc/firefox/syspref.js, for older versions: /etc/firefox/firefox.js
Linux (Debian)
/etc/firefox-esr/firefox-esr.js
Linux (Gentoo, Archlinux)
/usr/lib/firefox/mozilla.cfg, might also be /usr/lib32/ or /usr/lib64/
OS X
/Applications/Firefox.app/Contents/Resources/mozilla.cfg
Additional installation steps for Windows / OS X / Gentoo / Archlinux
Create local-settings.js in Firefox installation directory, with the following contents:
pref("general.config.obscure_value", 0);
pref("general.config.filename", "mozilla.cfg");
This file should be located at:
OS
Path
Windows
C:\Program Files (x86)\Mozilla Firefox\defaults\pref\
OS X
/Applications/Firefox.app/Contents/Resources/defaults/pref
Linux (Gentoo, Archlinux)
/usr/lib/firefox/defaults/pref/, might also be /usr/lib32/ or /usr/lib64/
If mozilla.cfg still fails to load, you must add a blank comment to the top of mozilla.cfg like so:
//
Additional settings (policies)
Not all Firefox settings can be changed through user.js - some must be set in a separate policies.json file [1]. These policies apply system-wide.
To install policies.json from this repository, simply copy it to the appropriate directory (create it if it does not exist):
OS
Path
Windows
C:\Program Files (x86)\Mozilla Firefox\distribution\
OS X
/Applications/Firefox.app/distribution\
Linux (Debian)
/etc/firefox-esr/policies/
Note that JSON does not support comments, hence settings are documented in custom *_comment keys. Mozilla maintains a list of available policies: [1] [2](https://github.com/mozilla/policy-templates). The Enterprise Policy Generator add-on can be used to generate policies.json files from a graphical interface.
Updating using git
For any of the above methods, you can keep your browser's user.js with the latest version available here: Clone the repository, and create a symbolic link from the appropriate location to the user.js file in the repository. Just run git pull in the repository when you want to update, then restart Firefox:
cd ~/.mozilla/firefox
git clone 'https://github.com/pyllyukko/user.js.git'
cd XXXXXXXX.your_profile_name
ln -s ${HOME}/.mozilla/firefox/user.js/user.js user.js
Verifying
Verify that the settings are effective from about:support (check the "Import
Read the full README on GitHubWhat Hacker News says
39 sourcesYou can set `about:config` settings in a text file as well[1]. And if you need to know what settings do what then this repo is handy[2].
1. http://kb.mozillazine.org/User.js_file
2. https://github.com/pyllyukko/user.js/
In My essential Firefox fixes in 2022You can set preferences with a user.js file in your profile directory. See for example: https://github.com/pyllyukko/user.js/blob/master/user.js
In Firefox about:config Menu ShortcutThank you for your suggestions. I've been considering what to do about my Firefox setup for some time (switching to ESR vs one of the forks, which I have to research first). Thing is, I'm using a heavily-customized profile with lots of extensions, Violentmonkey [1] userscripts, containers (including Containerise [2], and Temporary Containers [3]), and a custom user.js (based on [4]), so I should also revisit the settings for all of these at the same time as it's been a while since I last did so. It's all on my to-do list but as the current setup works well, there's always something more urgent to do instead.
1. https://violentmonkey.github.io/
2. https://github.com/kintesh/containerise
3. https://github.com/stoically/temporary-containers
4. https://github.com/pyllyukko/user.js
The LTSC suggestion is also good. I'm already using a heavily-
Read the rest
debloated LTSC with lots of unnecessary packages removed (including the hidden ones, which are not supposed to be officially removable), and all kinds of customizations for privacy, security, performance, and convenience. While I'm satisfied with my setup (automated with custom scripts I've been maintaining since Windows 8), the number of hoops one has to go through to have their computer do what the user wants and nothing else, or a "User-Agent" that gives actual agency to the user these days is truly astonishing, and makes the goal unattainable for most people.
Firefox also has a lot of settings that mitigate various finger printing techniques. There are some good sample configs on Github. [1]
Ironically, many of the settings can make you more unique because they disable a lot of functionality.
[1] https://github.com/pyllyukko/user.js
In Vulnerability allows cross-browser tracking in Chrome, Firefox, Safari, and TorThis [0] is a great set of configurations for the Firefox browser that remove many fingerprinting vectors. It turns on several fingerprint-homogenization features that the TBB project upstreamed into Firefox. Check it out!
(By using this, G--gle will hound you with impossible capchas and privacy-forward search engines will think that you're a bot.)
Most of these fingerprinting vectors are from the browser and the scourge of JS. I wonder about the footprint left by a user who doesn't use a browser, or instead uses some kind of parsing client that just fetches HTTP or data from API endpoint. Aside from the IP address, there are other ways to fingerprint a user based on network requests from various protocol leaks, many are presented here [1][2]. Are there any leak vectors missing from this list?
[0]: https://github.com/pyllyukko/user.js
[1]
Read the rest
I browse in firefox with javascript turned off, in ublock, with a bunch of other restrictions [0], and temporary containers. I make exceptions for a couple dozen sites, like my bank, open street maps, etc. Youtube is my only soft spot here, the rest of google I keep blocked. I can make one-off exceptions to read a tab in front of me, but that's not routine, it's not hard to find sites that support this.
[0] https://github.com/pyllyukko/user.js
In Firefox 85 cracks down on supercookiesI adapted a user.js template [1] that hardens Firefox by disabling a lot of features, including disabling Mozilla products like Pocket.
By default it is very strict though, so you will probably want to go through the config setting by setting and relax it a bit. Like enabling Webassembly and the search engine integration of the URL bar.
Most settings have inline comments explaining what they do and why they are chosen.
[1] https://github.com/pyllyukko/user.js
In Tor Browser 10I use next script. It creates temporarily dir for firefox, uses it as a profile dir and remove after firefox closed.
#!/bin/sh -e
DIR="${XDG_CACHE_HOME:-$HOME/.cache}"
mkdir -p -- "$DIR"
TEMP="$(mktemp -d -- "$DIR/firefox-XXXXXX")"
trap "rm -rf -- '$TEMP'" INT TERM EXIT
wget 'https://raw.githubusercontent.com/pyllyukko/user.js/master/user.js' -O "$TEMP/user.js"
firefox -profile "$TEMP" -no-remote "$@"
It also uses very hardened options from https://github.com/pyllyukko/user.js
It is not my invention, but I lost a link to blog post
In Ask HN: How do you set up a virtual browserThis is definitely something that should be fixed by the vendor, but as a (Firefox) user if you want a quick fix you can use https://github.com/pyllyukko/user.js
In Web browsers need to stop. Enough is enoughMozilla is going on the completely opposite direction of what their supporters (and previous contributors) want them to go.
Yes, they provide mobile browsers, plus a browser with "private mode" (focus) and now this. But on every single one of them, you have the same philosophy of Google Chrome (tm) adopted, of treating the user as a dumb gullible person that should not have access to important settings.
Why would they waste so much effort, and clone all the things people should avoid from Google Chrome?!
For example, any new tech introduced that can be used for browser fingerprinting and user tracking (e.g. canvas, webgl, webrtc, etc) is enabled to every single site by default, just like chrome.
Some you can install extensions (you can't on this and on mozilla focus), some you can fiddle with user-UNfriendly settings in about:config (desk
Read the rest
top and full featured android, not focus or this) where you have to guess setting names and cryptic values (what does 2 means in a setting named somethingEnabled?!)
Only on mozilla desktop you can standardize sane settings by importing a user.js file from the dozen of crowdsourced efforts (i recommend the most complete one from https://github.com/pyllyukko/user.js/ ). think about this, there's more then a dozen community led effort to provide sane defaults, not hardcore user optimized settings, sane defaults, for a project that should be open source and the users could have been able to send in patches to have sane defaults in the first place! now, why would those sane defaults everyone want would be denied in the main branch? because mozilla do not represent the users for a long time!
Mozilla is now a corporation that looks for Advertisement companies grants.
A quick reminder how to maintain your privacy while using Firefox (Windows pathnames):
1. Install Firefox with Internet disconnected. Do not install the Maintenance Service. Run once and then close it completely (Ctrl-Shift-Esc to check no processes are running).
2. Create and edit the file:
"%APPDATA%\Roaming\Mozilla\Firefox\Profiles\*.default\user.js"
Use the following as a template:
https://github.com/pyllyukko/user.js/blob/master/user.js
Best to read through the whole contents and edit it by hand as some of the settings might be too restrictive (there's a "relaxed" version too in another repository by the same author).
3. Create and edit the file:
"%ProgramFiles%\Mozilla Firefox\distribution\policies.json"
With the following contents:
{
"policies": {
"DisableAppUpdate": true
}
}
Note: This file and directory a
Read the rest
re being deleted every time you update Firefox, so be prepared to re-create them afterwards. Alternatively, it might also work to revoke the write permission to that directory but this could break the whole update process (I have yet to test it).
4. Update Firefox manually whenever a new version is released but wait for a while first, so that all the new anti-features such as this one come to light.
A year or so ago, they started sending telemetry letting them know that you have telemetry disabled! [0]
That one pissed me off, just on principle.
I'm not sure exactly what's happened in the last 10 years or so but, at some point, everyone apparently just decided it was okay to start spying on their users (read: "telemetry"). Mozilla and some others, at least, allow you to "opt out" -- although you should never have to! -- as if that somehow makes it okay.
Then, a while back, they decided they were going to go ahead and send in some "telemetry" even if the user has explicitly disabled telemetry!
I can easily remember a time -- and it wasn't that long ago! -- when slipping in even the slightest hint of "telemetry" without a clear, explicit "opt-in" from the user would have been absolutely unheard of.
Mozilla doesn't have much of a user ba
Read the rest
se left. You'd think they would try to avoid alienating us and pissing us off.
---
On a related note -- and with the above in mind -- I recently (within the last several days) started working on my own .js "preferences" to lock Firefox down as much as I can. I've just posted it [1] if anyone is interested (a lot of it was taken from [2]).
Disclaimer: it's very much still a work-in-progress, likely breaks things that I haven't noticed yet, and almost certainly is not what you want to use. I'm fairly happy with it at the moment, however. (There's a bunch of "notes to self" in there that I tried to remove; if I missed any, please just ignore them!)
[0]: https://blog.mozilla.org/data/2018/08/20/effectively-measuri... (see the "Telemetry Coverage" section)
[1]: https://gitlab.com/snippets/1904354
[2]: https://github.com/pyllyukko/user.js
start with https://github.com/pyllyukko/user.js/
In Firefox Privacy How-To Guide> How could Mozilla respect the needs of users who opt-out of Mozilla knowing they, and their needs, exist at all?
How about surveys or well, common sense?
I'm a tech oriented person who cares about privacy. I want software that is lightweight, configurable, with sensible defaults. For any features besides the basic functionality (in this case: browsing the web), I don't want to opt-out, I want to opt-in.
Privacy oriented means for me that the software I use doesn't send one bit of data that isn't necessary for its basic functionality. I use a "dumb phone" because of this. I never understood how anybody can think telemetry and privacy can co-exist.
I want a Firefox without Pocket, Send, Screenshot Tools, Sync, Clickz, any cloud based service. I only want a fast, lightweight browser that doesn't send any unnecessary data anywhere without m
Read the rest
e explicitly configuring it. That's a sensible default for me, really. Software used to be like that.
I'd also like to configure when my software looks for updates. My Linux distro let's me do that.
And it would be awesome if all other functionality (like Send/Sync/Pocket, etc.) is available via optional plugins, or in another "full-featured" version of Firefox. The deluxe edition or whatever.
I believe I'm not alone with these ideas about software. In discussions about Firefox these things always come up. There are github projects [1,2] with 1600 and 1200 stars about hardening Firefox. People care about privacy. It's not hard to find this part of the userbase.
The idea that you can't create software for your users without telemetry, is what leads Mozilla to disregard their privacy oriented users in the first place. It's depressing.
And even if I allowed telemetry on my system Mozilla wouldn't learn anything about what I wrote here. It's useless.
1: https://github.com/pyllyukko/user.js/
2: https://github.com/ghacksuserjs/ghacks-user.js
Showing the 15 most recent of 39 sources. Enable JavaScript to search and browse every indexed mention.